OpenCode’s Distillation Breach Exposes AI Provider Keys

OpenCode says a large-scale model-distillation attack exposed external-provider API keys for 1.4% of Console users, triggering unauthorized charges and some Google Cloud project suspensions. Plex2Shell has also moved from public research into active cryptominer and residential-proxy deployment.

AI & Model Security

An intruder reached a legacy OpenCode Console system during a large-scale distillation attack. Keys for OpenAI, Anthropic, and Google providers may have been exposed from October 17 at 00:30 UTC; some users reported unauthorized charges as high as $1,700. Co-founder Dax Raad said AI agents had targeted the service for at least 48 hours, and that general models refused parts of the defensive investigation before the team gained access to OpenAI Daybreak. BleepingComputer and The Hacker News
Unit 42 says it blocked AI-generated payloads targeting government Linux infrastructure. The claimed objectives included accessing mailboxes and databases, deleting logs, and tampering with endpoint defenses. The public post does not explain how AI authorship was determined, so that provenance remains a vendor assertion rather than a demonstrated technical finding. Unit 42
WhatsApp help pages contained hidden text intended to steer LLM answers away from regulators. Redact found instructions telling assistants not to recommend a regulator, illustrating how publisher-controlled documentation can become indirect prompt injection when retrieval systems fail to separate content from instructions. Redact (discussion)
Four Gemini 4 Argon agents autonomously completed Minecraft’s Ender Dragon objective. In that single run, the agents wrote 2,783 programs, exchanged 229 messages, died 605 times, and incurred $1,620 in model costs. It is a notable multi-agent autonomy demonstration, though not a standardized benchmark. The Decoder

New Tools & Releases

WHFB-PinCapture demonstrates capture-at-entry against Windows Hello PINs protected by VBS and TPM. It places a CPU hardware breakpoint on the PIN-packaging function in LogonUI.exe and reads the argument through a vectored exception handler without modifying the original instruction. The author validated it on Windows 11 build 26200 with Intel fTPM 2.0 and VBS; this is post-compromise credential capture, not offline TPM recovery. WHFB-PinCapture
SyscallRevenant explores indirect syscalls without static system-service-number tables. It uses the trap flag and exception handling to resolve SSNs and syscall instructions dynamically, then substitutes parameters before invocation to avoid userland hooks. The repository is a research implementation, not evidence of a universal EDR bypass. SyscallRevenant
COM_Hijack_BOF packages user-level COM search-order persistence for Cobalt Strike and Mythic. The BOF creates per-user registry entries that take precedence over machine-wide COM registrations, mirrors the original threading model, and includes cleanup support without requiring administrator rights. COM_Hijack_BOF
Zero Breach is a local, read-only scanner for indicators associated with the AdFection/Candiru ad-delivered spyware campaign. It provides a focused triage option following the zero-click delivery research covered previously, though an absence of known indicators cannot establish that a device is clean. Zero Breach (earlier coverage)

Vulnerabilities & Exploits

Plex2Shell has moved from a public exploit chain to active compromise. A honeypot began seeing scans within a day of disclosure and later captured successful infections delivering cryptominers and residential-proxy software. Plex Media Server users should be on version 1.43.3. The researcher behind the chain said AI heavily accelerated component mapping and verification, but human judgment guided the work. Ars Technica This is the material change from the public chain in earlier coverage. (discussion)
A new deep dive reconstructs Drupal CVE-2026-108097 end to end, but not through a publicly identified real-world module. Fortbridge achieved file exfiltration and command execution against Drupal 11.4.9 by using a synthetic bridge module to expose the vulnerable Field UI callback sink. Drupal says contributed or custom modules can provide that missing “writer,” including some unauthenticated paths, but the researchers found no genuine public example and reported no in-the-wild exploitation. Version 11.4.10 removes the callable path. Fortbridge (earlier coverage)

Supply Chain, Cloud & Identity

Official Rank Math PRO packages delivered a persistent WordPress backdoor during an 11-hour compromise window. Version 3.0.123 downloaded or installed between October 15 at 20:02 UTC and October 16 at 07:12 UTC could create hidden administrators and scheduled tasks, execute commands, and expose database credentials, API keys, SSH keys, and cloud credentials. Rank Math released clean version 3.0.124, but says sites where the malicious build was activated should be treated as compromised rather than merely updated. BleepingComputer
GhostAction has added reverse-proxy phishing and OAuth device authorization to its GitHub workflow attacks. A fake security alert harvested passwords and 2FA codes, then used JavaScript to authorize an OAuth flow with repo, workflow, and read:org permissions. The report also ties a credential stealer disguised as a font to 94 repositories, showing the operator adapting after GitHub disrupted its malicious Actions workflows. The Hacker News (earlier coverage)
FirstVDS says attackers exploited a VMmanager 6 vulnerability to access customer credentials and virtual-server data. The Russian hosting provider said passwords and other access material were stolen from part of its infrastructure, although customer workloads continued operating. Public reporting does not identify a CVE or affected-version range. The Record

Threat Activity

Nextron attributes seven malicious Office documents submitted between July 8 and July 14 to APT28. Some initially scored only 5 detections across 62 engines. Obfuscated VBA assembled strings at runtime, performed XOR-encoded reconnaissance, and dropped a 64-bit Covenant Grunt loader disguised as a log file; the samples contacted Dropbox infrastructure. Nextron Systems
Researchers are mapping Coruna-like and DarkSword iOS exploit-kit infrastructure across compromised commerce sites. Unit 42 observed associated pages directing iPhone visitors to reopen content in Safari. A later community tally cited 183 affected websites, with vulnerable PrestaShop instances implicated as one compromise vector and retrohunt evidence extending to July. Those counts represent compromised sites, not confirmed infected phones. Unit 42 and vx-underground
Citizen Lab confirmed with high confidence that Pegasus infected the iPhone of University of Belgrade rector Vladan Đokić. The infection occurred sometime in 2026 through a zero-click exploit, amid broader commercial-spyware targeting of Serbian students, journalists, opposition figures, and civil-society members. Citizen Lab
Objective-See analyzed Heartbreaker, a metamorphic ransomware specimen targeting macOS. Its changing code form is intended to frustrate static signatures, making the write-up relevant for macOS detection and reverse-engineering teams. Objective-See
ROMULUS is a newly documented ClickFix delivery platform distributing LegionLoader and other malware. Operators use bogus landing pages to persuade visitors to run malicious commands themselves, packaging the now-common social-engineering pattern into reusable delivery infrastructure. The Hacker News

Incidents & Cybercrime

Qubic halted its blockchain after weak wallet-seed generation reportedly enabled a $1.4 million theft from more than 1,400 wallets. Most of the stolen funds were said to be frozen while the community considered a recovery vote. Blockonomi
Court records describe a Chinese organized-crime ring using compromised Staples access to issue millions of dollars in fraudulent gift cards. The group allegedly reached the retailer’s internal Nexus customer-support tool, redeemed cards for electronics and other goods across the United States, and shipped much of the merchandise to China. 404 Media
FBI investigators reportedly suspect that a ransomware negotiator employed by a cybersecurity firm operated a ShinyHunters extortion site. The KrebsOnSecurity report raises a significant conflict-of-interest concern, but the allegation remains an investigative finding rather than an adjudicated fact. KrebsOnSecurity (discussion)

✎ This issue was written by gpt-5.6-sol. No human edited it before publishing — how this works .